Product by Red Hat
Red Hat Openshift AI (rhoai)
39 known vulnerabilities in Red Hat Openshift AI (rhoai) (Red Hat), 0 of them actively exploited (CISA KEV).
Key figures
39
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
4
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-23536 | Feast: unauthenticated arbitrary file read | 7.5 | |
| Critical | CVE-2026-18948 | Red Hat OpenShift AI: Deserialization of Untrusted Data | 9.9 | |
| Critical | CVE-2026-23537 | Feast: unauthenticated arbitrary file write | 9.1 | |
| Critical | CVE-2026-14450 | Maas-billing: maas api: privilege escalation via forged http headers due to missing authentication | 9.9 | |
| High | CVE-2026-18941 | Red Hat OpenShift AI: Missing Authentication for Critical Function | 7.7 | |
| High | CVE-2026-0603 | Org.hibernate/hibernate-core: SQL Injection | 8.3 | |
| High | CVE-2026-23538 | Feast: resource exhaustion via websocket endpoint | 7.5 | |
| High | CVE-2026-18947 | Red Hat OpenShift AI: Denial of Service | 8.5 | |
| High | CVE-2026-13717 | Red Hat OpenShift AI (RHOAI): Improper Access Control | 8.8 | |
| High | CVE-2026-18950 | Red Hat OpenShift AI: Incorrect Privilege Assignment | 8.8 | |
| High | CVE-2026-56211 | Libaom: libaom: remote code execution via svc layer context handling with attacker-controlled frames | 7.1 | |
| High | CVE-2026-87743 | Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security | 7.5 | |
| Critical | CVE-2026-5483 | Odh-dashboard: odh dashboard kubernetes service account exposure | 9.9 | |
| High | CVE-2024-7557 | Odh-dashboard: odh-model-controller: cross-model authentication bypass in openshift ai | 8.8 | |
| High | CVE-2026-56208 | Libaom: libaom: heap buffer overflow in av1 encoder first-pass stats buffer via lap mode | 7.6 | |
| High | CVE-2026-56209 | Red Hat: Out-of-bounds Write | 7.1 | |
| Medium | CVE-2026-92091 | Jwcrypto: jwcrypto: denial of service via o(n^2) duplicate check on unbounded jwk key_ops array | 5.9 | |
| Medium | CVE-2026-12706 | Ffmpeg: ffmpeg: heap use-after-free read in rasc decoder decode_move() | 6.5 | |
| High | CVE-2026-108334 | Red Hat: Expression Language Injection | 7.4 | |
| High | CVE-2026-56210 | Libaom: libaom: heap-buffer-overflow read via missing bounds check in ctrl_set_layer_id | 7.1 | |
| Medium | CVE-2024-11831 | Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript | 5.4 | |
| Medium | CVE-2026-86332 | Odh-dashboard: odh-dashboard: nim credential secret readable by any authenticated user | 6.5 | |
| Medium | CVE-2026-17557 | Red Hat OpenShift AI (RHOAI): Server-Side Request Forgery (SSRF) | 6.5 | |
| High | CVE-2025-12805 | Llama-stack-k8s-operator: llama stack service exposed across namespaces due to missing networkpolicy | 8.1 | |
| Medium | CVE-2026-18393 | Ffmpeg: ffmpeg: heap buffer overflow in tdsc_load_cursor() via cur_fmt_mono cursor | 5.4 |
News
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 26sans-atrisk-mail,